[BUG] fix openvex report oci id

[sozercan]

Version of copa

No response

Expected Behavior

it should be:

"@id": "pkg:oci/nginx@sha256....",

https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#oci

However, I am not sure if we can do this since image is not at the registry at this time so sha256 will not be accurate. tag might be more suitable?

Actual Behavior

vex statement output has

"@id": "pkg:oci/docker.io/library/nginx:1.21.6-patched",

https://project-copacetic.github.io/copacetic/website/output

Steps To Reproduce

No response

Are you willing to submit PRs to contribute to this bug fix?

• Yes, I am willing to implement it.

[shubhamsugara22]

@sozercan looks a good first issue to work on this repo but will need more info ?
can i try this
Thanks

[prakrit55]

@sozercan, can image be an image digest if yes then we can modify the patchWithContext( ) there.
@shubhamsugara22, I am also on it

copacetic/pkg/patch/patch.go

Line 78 in aec1c59

imageName, err := reference.ParseNormalizedNamed(image)

[shubhamsugara22]

@prakrit55 Didn't see any comment , that's fine , will also update if found any helpful info , also looking to collaborate on this one or flying solo?

[prakrit55]

@prakrit55 Didn't see any comment , that's fine , will also update if found any helpful info , also looking to collaborate on this one or flying solo?

@shubhamsugara22, you can work into it, I will go find another one 😄

[robert-cronin]

I'd love to take a shot at this bug if everyone is okay with it!